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ABSTRACT 


This thesis was designed as a reference guide for 
managers, specifically Commanding Officers and Comptrollers, 
concerning the internal control system and control programs. 
It provides a general overview of the internal control system 
and discusses the various external and internal audits, 
inspections, reviews and investigative organizations and 
programs. The thesis defines the audit system and includes 
audit standards and the audit process- Pra^-tic?.! guidelines 
for preparing for and participating in audits or inspections 
are included. An additional reading list of relevant direc¬ 
tives and instructions governing the various programs and 
agencies is intended as a central resource for managers to 
obtain additional information. 
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I. 


INTRODUCTION 


A. DISCUSSION 

Taxpayers are becoming increasingly concerned with how the 
government spends its money, particularly in defense-related 
areas. With constant discussions concerning the spiraling 
budget deficit and resultant interest payments, the media and 
taxpayers are demanding closer scrutiny of the budget and how 
government funds are spent. 

Congress attempts to control wasteful spending through 
budget restraints. For instance, audit reports generally 
recommend various savings and benefits. Theoretically, if the 
recommendations are enacted by the auditee, budget savings 
should accrue. However, if these recommendations are not 
implemented. Congress can restrict the budget to the amount of 
the projected savings under the assumption that an efficiently 
managed program would require less funding. 

The Accounting and Auditing Act of 1950 required internal 
control systems and placed the responsibility for developing 
them on agency heads. The Federal Manager's Financial 
Integrity Act of 1982 required, among others, standard 
controls. These two acts created various programs. 
Specifically in the Navy, auditors were assigned to verify 
compliance with the controls, the Internal Review Program was 
developed to help Commanding Officers assess their commands' 
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compliance with controls, and finally, the Management Control 
Program placed responsibility on functional managers to assure 
adequate controls exist in their organizations. 

Although these programs still exist, a changing 
perspective has developed. Auditors rely less on compliance 
audits and spend more of their time assessing the effective¬ 
ness and efficiency of certain programs in terms of monetary 
benefits. Compliance has not been deleted as a prime concern, 
only given less priority. 

Currently, the Naval Postgraduate School teaches the 
Practical Comptrollership Course and Financial Management in 
the Armed Forces Course, using the same text for both. The 
present chapter on auditing provides a detailed background on 
the history of audits and controls as well as the organiza¬ 
tions involved. It does not offer a practical approach for 
preparing and participating in the audit. 

Recent policy changes throughout the audit, review and 
control programs need to be incorporated into the chapter. 
For example, the Naval Audit Service, within the past couple 
of years, changed its audit emphasis from the short, 
compliance audits of activities to the longer, more complex 
program audits. A second example involves the very recent 
cancellation of the Internal Review Program by the Secretary 
of the Navy. 
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B. PURPOSE OF RESEARCH 

The primary purpose of this thesis was to develop a 
practical reference guide for managers, specifically 
Commanding Officers and Comptrollers, concerning the internal 
control system and control programs. This guide will be 
incorporated into the text used in the Practical 
Comptrollership Course and Financial Management in the Armed 
Forces Course at the Naval Postgraduate School. 

C. SCOPE OF RESEARCH 

This thesis reviews: 

- current control, audit, and review policies. 

standards for internal controls, audits and the audit 
process. 

information regarding the various audit, investigation 
and review organizations which affect the Navy. 

guidelines for preparing and participating in an audit. 

rights for the audited organization. 

Since the purpose of the thesis is to develop a desktop 
reference guide, a synopsis was used, providing necessary 
information for the understanding of the programs and 
standards. Instructions and directives provide full details 
and discussions for each. 

D. RESEARCH APPROACH 

Research for this thesis covered two areas: an exhaustive 
review of pertinent directives and instructions, and 
interviewing various managers. Interviews with program 
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headquarters’ staff facilitated a better understanding and 
clarity of the written directives. Interviews with field 
managers provided experienced advice for participating in 
audits, reviews and inspections. 

Due to the variety of agencies and programs examined in 
this thesis, no standard questionnaire was developed. 
Information gathered through the interview process was the 
result of free-form commentary, personal and phone interviews 
from members of various comptroller departments, at all 
levels; commanding officers; former internal review staff 
members; and field auditors of the Naval Audit Service, as 
well as headquarters staff of the various audit, review and 
inspection agencies. Interviews lasted between 45 and 90 
minutes. 

Interviewees included the following commands and agencies: 

Office of Inspector General, Department of Defense. 

Office of Inspector General, Department of the Navy. 

Naval Military Personnel Command. 

Naval Supply Systems Command Headquarters. 

Navy Accounting and Finance Center, Washington, D.C. 

Naval Audit Service, Washington, D.C. 

Commander in Chief, U.S, Pacific Fleet (CINCPACFLT), 

Pearl Harbor. 

Naval Air Force, U.S. Pacific Fleet (AIRPAC), San Diego. 

Naval Surface Force, U.S. Pacific Fleet (SURFPAC). 

Naval Postgraduate School, Monterey. 


4 






Naval Air Station, Alameda. 

Naval Air Station, Whidbey Island. 

Naval Air Station, Lemoore. 

Naval Sub Base, Bangor. 

Defense Investigative Service, Monterey. 

Naval Investigative Service, Resident Agency, Monterey. 

E. THESIS ORGANIZATION 

The thesis is organized as follows: Chapter I provides 
the methodology and scope of the thesis. Chapter II gives a 
general overview of the internal control system and discusses 
the various external and internal audits, inspections, reviews 
and investigative organizations and programs. Chapter III 
defines the audit system, and includes audit standards and the 
audit process. Chapter IV provides practical guidelines for 
preparing for and participating in audits or inspections. 

Finally, an additional readings list is attached as an 
appendix. This detailed list of the directives and 
instructions governing the various programs and agencies is 
intended as a central resource for managers to obtain 
additional information relevant to each chapter. 
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II. 


INTERNAL CONTROL SYSTEM 


This chapter introduces the topics of management control 
and auditing in the Navy, including various external and 
internal audit organizations and programs, Inspector General 
(IG) inspections, internal review organizations as well as the 
Management Control Program. 

A. REASONS FOR MAINTAINING A CONTROL SYSTEM 

An entity's management is responsible for establishing 
an internal control structure to assure compliance with laws 
and regulations. The lack of administrative continuity in 
government units because of continuing changes in elected 
legislative bodies and in administrative organizations 
increases the need for an effective internal control system. 
[Ref. l:p. 4-2] 

In an era of decreasing resources due to budget deficits 
and competing requirements, federal government financial 
managers should actively promote economy, effectiveness and 
efficiency when expending financial resources. This entails 
strong management controls. To provide "maximum benefit with 
minimum effort (efficiency)" [Ref. 2:p. 20] without 
considering the cost implications (economy) or ability to 
achieve one's mission (effectiveness) does a disservice to the 
federal government and management's role in preserving the 
integrity of the financial affairs of the government. [Ref. 

2:p. 20] 
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with increasing oversight from the media, Congress and the 
public, failure to use financial resources economically, 
efficiently and effectively could result in funds recoupment 
by higher authority. 

Through the reports generated by the various audit and 

control agencies. Congress attempts to promote greater 

economy, effectiveness, and efficiency by controlling and 

restraining those areas of the budget which are identified in 

the reports as areas of concern and weakness. Managers must 

take strong action to correct these areas or face budget 

sanctions. For example, in 1985, 

...the House Committee on Armed Services has become aware of 
the Navy inaction in improving its internal audit function 
and, to emphasize its concern, deleted $100 million from the 
Navy Fiscal Year 1988 (FY88) Operation and Maintenance 

budget request. The Government Accounting Office (GAO) 
concluded the congressional message is that an effective 
Navy audit organization would have identified at least $100 
million in potential monetary benefits from its 
recommendations. [Ref. 3:p. 64] 

The periodic rotation of managers provides opportunities 
for inefficiency or fraud since managers typically are 
concerned with short-term goals at the expense of long-term 
results. With a good control system, managers have set 
performance standards with which to judge organizational 
effectiveness, allowing weaknesses to be detected and 
corrected. Problem areas not internally detected may be 
detected through other control systems such as external audits 
or inspections. 
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As a control measure, audits and inspections keep managers 


informed of areas of strength, weakness or possible 
misrepresentation by employees. Audits and inspections serve 
as an instrument with which to recognize outstanding 
performance, and as a deterrence against fraud, waste and 
abuse. The potential for fraud, waste or abuse is diminished 
if the staff expects an independent third-party review and 
verification of their respective actions. 

A good internal control and review system helps management 
recognize deficiencies thus allowing an opportunity for 
immediate identification of problem areas and required 
corrective action. It also helps to identify potential repeat 
audit findings. 

A well-run organization should welcome audits and reviews 
for two reasons. Problem areas identified in an audit can be 
corrected, developing a more efficient and effective 
organization; and those organizations with no problems can be 
recognized as such due to the lack of audit findings. [Ref. 
4] 


B. THE INTERNAL CONTROL STRUCTURE 

Auditing textbooks define the internal control structure 
to "include the control environment, the accounting system and 
the control procedures." [Ref. 5:p. 274] According to the 
Comptroller General, "good internal controls are essential to 
achieving the proper conduct of Government business with full 
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accountability for the resources made available." [Ref. 6:p. 
1 ] 


The control environment reflects the overall philosophy of 
top management. [Ref. 5:p. 274] Department of Defense (DOD) 
philosophy states 

Internal controls are management's responsibility and should 
be in effect across the board in every organization within 
each DOD component. Adequate internal control is required 
to assure that all resources are efficiently and effectively 
managed and is the basic foundation for integrity in any 
management system. Although internal controls in themselves 
cannot prevent every incident of waste, mismanagement, and 
fraud, DoD policy is to ensure that resources are properly 
managed and controlled within the Department of Defense. 
[Ref. 7:p. 1] 

The accounting system pertains to the control over the 
entity's transactions and the related assets. [Ref. 5:p. 274] 

The Accounting and Auditing Act of 1950 requires agency 
heads to establish and maintain effective systems of internal 
control. The objectives require that: 

a. Obligations and costs comply with applicable law 

b. Assets are safeguarded against waste, loss, unauthorized 
use, and misappropriation 

c. Revenues and expenditures applicable to agency 
operations are recorded and accounted for properly so that 
accounts and reliable financial and statistical reports may 
be prepared and accountability of the assets may be 
maintained. [Ref. 6;Introduction] 

Although the objectives of internal controls seem to 
indicate that financial programs are the only programs which 
are of concern, this is not the intent. Internal controls 
apply to all programs, administrative and operational. [Ref. 
8:p. 9] 
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Control procedures allow management to meet these 
objectives. [Ref. 6:p. 1] The control procedures established 
in an organization reflect the minimum level of quality 
performance required. [Ref. 6:p. 2] An effective control 
system can diminish, but not necessarily eliminate, the 
opportunity for collusion or fraud. 


C. TYPES OF CONTROLS 

Government controls are classified as either general, 
specific or audit resolution standards. These controls were 
developed by the Comptroller General as a requirement of the 
Federal Managers' Financial Integrity Act of 1982 (31 U.S.C. 
3512(b)). Office of Management and Budget (0MB) Circular No. 
A-123 revised, dated August 16, 1983 has a full discussion of 
the standards. 

1. General Standards 

a. Reasonable Assurance. Internal control systems are 
to provide reasonable assurance that the objectives of the 
systems will be accomplished. The benefits derived should 
exceed the cost of the internal control system. The 
benefits should reduce the risk of failing to achieve the 
control objectives. 

b. Supportive Attitude. Managers and employees are to 
maintain and demonstrate a positive and supportive attitude 
toward internal controls at all times. 

c. Competent Personnel. Managers and employees are to 
have personal and professional integrity. They are to 
maintain a level of competence that allows them to 
accomplish their assigned duties, as well as understand the 
importance of developing and implementing good internal 
controls. 
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d. Control Objectives. Internal control objectives are 
to be identified or developed for each agency activity and 
are to be logical, applicable, and reasonably complete. 

e. Control Techniques. Internal control techniques are 
to be effective and efficient in accomplishing their 
internal control objectives. Control techniques promote 
consistent performance. 

2. Specific Standards 

a. Documentation. Internal control systems and all 
transactions and other significant events are to be clearly 
documented, and the documentation is to be readily available 
for examination. 

b. Recording of Transactions and Events. Transactions 
and other significant events are to be promptly recorded and 
properly classified. 

c. Execution of Transactions and Events. Transactions 
and other significant events are to be authorized and 
executed only by persons acting within the scope of their 
authority. Authorizations are to be made in writing. 

d. Separation of Duties. Key duties and responsibili¬ 
ties in authorizing, processing, recording, and reviewing 
transactions should be assigned to separate individuals to 
minimize the risk of loss to the government. 

Internal control depends largely on the reduced 
opportunities to make and conceal errors or to engage in or 
conceal irregularities. This, in turn depends on the 
assignment of work so that no one individual controls all 
phases of an activity or transaction, thereby creating a 
situation that permits errors or irregularities to go 
undetected. 

e. Supervision. Qualified and continuous supervision 
is to be provided to ensure that internal control objectives 
are achieved, and approved procedures are followed. 

Lines of personal responsibility and accountability are 
to be clearly established. 

f. Access to and Accountability for Resources. Access 
to resources and records is to be limited to authorized 
individuals, and accountability for the custody and use of 
resources is to be assigned and maintained. Periodic 
comparison shall be made of the resources with the recorded 
accountability to determine whether the two agree. The 
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frequency of the comparison shall be a function of the 
vulnerability of the asset. 

3. Audit Resolution Standard 

a. Prompt Resolution of Audit Findings. Managers are 
to (1) promptly evaluate findings and recommendations 
reported by auditors, (2) determine proper actions in 
response to audit findings and recommendations, and (3) 
complete, within established time frames, all actions that 
correct or otherwise resolve the matters brought to 
management's attention. [Ref. 9:p. 6-8] 

D. INTERNAL CONTROL SYSTEMS 

The major systems of internal control for the Department 
of the Navy include formal audits, economy and efficiency 
reviews (formerly, internal review) and the Management Control 
Program. These management tools help ensure the integrity of 
the system and complement each other. Controls form the basis 
from which audits and reviews are performed. 

The chief differences between the programs reflect the 
level of independence provided to the command being inspected, 
audited or reviewed. 

Audits are the formal program which management can use to 
evaluate its control system. Audits differ from management 
control reviews and economy and efficiency reviews in that 
they are performed by qualified professional auditors 
following GAO Audit standards. These auditors are independent 
from the influence of the function being audited. Audit 
results are made available to those interested, including 
Congress, and other auditing and inspection agencies. 
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Economy and efficiency reviews lie strictly within the 
confines of the command for the Commanding Officer's sole use 
as an internal assessment of the control system. Personnel 
assigned to the command conduct the reviews. The findings are 
confidential and not released outside the command; thus, the 
Commanding Officer has the incentive to investigate and 
correct problem areas promptly. 

The Management Control Program is a review performed by 
the managers themselves to determine whether their functional 
area has adequate internal controls based on levels of 
vulnerability and risk. Review results are incorporated into 
the command's consolidated report. The Commanding Officer 
determines which areas are reported to the next level in the 
chain of command. Each echelon level command merges the 
reports until they are consolidated at the DOD level into a 
joint service report that is presented to Congress and the 
President. 

E. EXTERNAL AUDIT, INVESTIGATIVE AND INSPECTION ORGANIZATIONS 

Since reports from external (to the DON) organizations 
sometimes recommend areas where economic savings could accrue, 
any concurrence could affect future budget plans. If managers 
do not agree with the findings, they should justify their 
rationale for not concurring. For example, a manager could 
request additional sampling if the original sample was not an 
accurate portrayal of events. 
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1. Conaressionallv Controlled Oversight Organizations 


The Government Accounting Office (GAO) is responsible for 
making independent evaluations of agencies and functions of 
the Executive Branch of the government.... GAO reports 
generally contain findings, conclusions and recommendations 
that identify problems, highlight areas where management 
could be improved, and offer potential corrective actions. 
The reports have a substantial impact on Congressional and 
public views concerning DON activities. [Ref. 10;p. 1] 

The Surveys and Investigations Staff of the House 
Appropriations Committee reviews Navy programs for Congress. 
Since the reviews are not conducted by professional auditors, 
they are not bound by the strict GAO Standards or audit 
objectives. Thus, their conclusions and recommendations may 
not be statistically accurate. 

2. Military Oversight Organizations 

The following major operational audit and inspection 

organizations are designed to meet DOD policy 

...to provide adequate audit coverage of all DoD organiza¬ 
tions, programs, activities, and functions as an integral 
part of the DOD management system. The objectives of 
auditing are to conduct independent evaluations of DOD 
programs and operations, and to determine whether internal 
control systems are adequate; information is reliable; 
applicable laws, regulations and policies are followed; 
resources are safeguarded and managed economically and 
efficiently; and desired program results are achieved. 
[Ref. ll:p. 1-2] 

a. Inspector General 

(1) DOD Inspector General (DODIG) . 

The Inspector General is required to...conduct, supervise, 
monitor, and initiate audits and investigations relating to 
programs and operations of the DOD; provide leadership and 
coordination and recommend policies for activities designed 
to promote economy, efficiency, and effectiveness in the 
administration of, and to prevent and detect fraud and abuse 
in, such programs and operations; provide a means for 
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keeping the Secretary of Defense and the Congress fully and 
currently informed about problems and deficiencies relating 
to the administration of such programs and operations and 
the necessity for and progress of corrective action. [Ref. 

12:p. 1-2] 


The major thrust of IG inspections centers on 
mission economy and effectiveness, and reviewing special 
interest items. These inspections differ from audits in that 


they are 

not performed by 

professional 

auditors nor 

are 

auditing 

standards 

followed 

. They are 

very limited 

in 

duration, 

generally 

lasting 

a few weeks 

versus months 

or 


years. 


Special interest items are the result of 
Congressional interest and/or common, recurring discrepancies 
found during inspections. The major high interest items for 
FY90 are DOD Environmental Program; Health Care; Defense 
Management Report; Manpower and force structure; product 
substitution, defective pricing and poor accounting systems. 
IG teams routinely investigate hotline tips. [Ref. 13] 

DOD IG is a civilian appointed by the 
President with the consent of the Senate. [Ref. 12:p. 1-2] 

(2) Department of the Navy fPON^ Inspector 
General (NAVINSGEN) . 

As the principle advisor on all inspection and noncriminal 
investigation matters it js intended that NAVINSGEN act as 
the "eyes and ears" of SECNAV, CNO and CMC in all integrity 
and efficiency matters. The term "inspection" encompasses 
not only command inspections, but the efforts of any group 
or person within the DON who evaluates units and activities. 
This term encompasses all examinations and inquiries into 
any matter in which DON has interest which are not included 
in NAVINSGEN's annual integrity and efficiency plan. [Ref. 
14:p. 2] 
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These inspections concentrate on compliance 
an^ operational issues. NAVINSGEN is a military component of 
the Office of the Secretary of the Navy. The IG teams are 
normally comprised of a permanent cadre of military and DON 
civilian personnel, occasionally supplemented with subject 
area experts from the field. 

Major/sub claimant IG teams operate under the 
NAVINSGEN instruction. All reports are sent to NAVINSGEN. 

OPNAVINST 5040 lists the NAVINSGEN special 
interest items. Appendix A lists common discrepancies found 
during command inspections. 

b. Defense Contract Audit Agency 

The Defense Contract Audit Agency provides 
contract audit services as well as accounting and financial 
advisory services to all DOD activities responsible for 
procurement and contract administration. [Ref. 15:p. 1] The 
director, a civilian selected by the Secretary of Defense, 
receives agency direction and authorization from the Assistant 
Secretary of Defense (Comptroller). 

c. Naval Audit Service 

The Naval Audit Service is the central audit 
agency for the Navy. 

The mission of the Naval Audit Service is to perform 
internal audits of DON organizations, programs, systems, 
activities, functions and funds and to issue reports on 
these audits that describe conditions found and any 
corrective actions needed. [Ref. 16] 
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The major focus of the Naval Audit Service is 
concentrated on large, high-dollar value, multi-function 
program audits. As a result, the audit may take up to a year 
or more to complete. 

The Naval Audit Service performs other functions, such as 
providing audit policy guidance, surveillance, and review of 
audits conducted by nonappropriated fund organization 
auditors; monitoring Department of the Navy contracts for 
audit services to ensure compliance with DOD guidance; 
supporting the Naval Inspector General in executing the 
Department of the Navy Audit Follow-up Program; serving as 
the focal point for internal audit policy relative to the 
Department of the Navy Management Control Program, and 
providing audit assistance to the Naval Investigative 
Service Command. [Ref. 17:p. 2] 

Additionally, a limited management consulting 
service is available upon request. This service differs from 
an audit because the report remains confidential and is not 
released to outside parties. 

The Auditor General of the Navy determines whether 
the management consulting service is more appropriate than an 
audit. The Naval Audit Service will recommend an audit if the 
initial investigation determines fraud or waste may exist, and 
will immediately prioritize the consulting request into the 
audit plan. When resources become available, an audit will be 
conducted. [Ref. 18] 

The Auditor General of the Navy, a career civil 
servant, is directly subordinate to the Under Secretary of the 
Navy and serves in three capacities; Auditor General of the 
Navy; Director, Naval Audit Service; and Executive Staff 
Extension of the Under Secretary of the Navy. [Ref. 17:p. 2] 
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Appendix B discusses the current operational and 
organizational structure of the Naval Audit Service, and 
provides selections from the current audit plan. 

d. Naval Investigative Service Command (NIS) 

NIS maintains specialized fraud units throughout 
the world to investigate fraud and criminal activities. [Ref. 
19] Auditors are not trained to perform criminal investiga¬ 
tions. If potential evidence of fraud or other criminal 
activity is uncovered during an audit, the auditor can expand 
the scope of the audit to verify the evidence. If verified, 
the auditor furnishes a written report of the suspected 
activities to the director or director's superior, the Naval 
Inspector General and Naval Investigative Service Command for 
investigation. 

The NAVIG and Naval Investigative Service Command then 
will determine at what level to brief any known or suspected 
instances of illegal actions. Where criminal activity is 
suspected during the audit, any notification or dissemina¬ 
tion of audit reports will be coordinated with the Naval 
Investigative Service Command. This is to preclude 
compromise of the investigation or destruction/alteration of 
evidence. [Ref. 17:p. 7] 

F. INTERNAL ASSESSMENT PROGRAMS 

These reviews are conducted by personnel attached to the 
command. 

1. Internal Review 


Internal Review provided Commanding Officers an 
internal asset to assess the economy and effectiveness of 
their command functions. The reports generated by the 
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command's Internal Review staff were for the Commanding 
Officer's sole use and were strictly confidential. This gave 
the Commanding Officer the flexibility to direct the Internal 
Review staff to review areas of concern without delay. Since 
the results of these reviews remained within the command, the 
Commanding Officer could be assured of confidentiality thus 
providing an incentive for self-identification and correction 
of command problem areas. 

In 1989, SECNAVINST 7510.9 canceled Internal Review as 
a required program; however Commanding Officers remain 
responsible for their command's economy and efficiency. They 
have the option of organizing their staff to perform reviews 
in a manner which is most effective for the command. 

SECNAVINST 7510.9 requires any review termed "audit" 
to comply with GAO and Naval Auditing Standards, be performed 
by professional auditors and reviewed by the Navy Auditor 
General. When this occurs, the review no longer is 
confidential and can be made available to outside, interested 
parties. Since these reviews were initially intended to be a 
confidential management tool for the commanding officer's sole 
use, the majority of commands have replaced the term "audit" 
with "study," "evaluation," "review," "inspection," or "quick 
look"; and have changed the job series classifications of 
their review staff from GS-511 (Auditor) to GS-510 (Accoun¬ 
tant) or CS-343 (Management Analyst). However, interviewees 
stated they will continue to follow tne audit standards. 
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Economy and efficiency reviews "focus on areas to 
reduce costs of operations, increase production and eliminate 
waste, fraud and abuse." [Ref. 20:p. 2] Areas generally 

covered include the appropriated and non-appropriated 
activities for financial compliance. Major echelon commanders 
have developed specific policy and guidance in this matter. 

Commands are required to provide an audit liaison 
service for outside agencies to conduct audits, reviews and 
inspections. 

Liaison includes the following: 

1. providing administrative support; 

2. arranging for suitable office space and equipment; 

3. coordinating dates, times and locations for entrance and 
exit conferences; 

4. determining points of contact within various functional 
areas; 

5. maintaining pertinent records; 

6. coordinating management responses to findings and 
recommendations; and 

7. coordinating audit resolution efforts between audit 
agencies and managers. [Ref. 21:p. 4] 

2. Management Control Program 
a. Definition 

The Management Control Program is the formal 
process of an organization which evaluates whether internal 
controls exist and are effective throughout the organization. 
The Management Control Review is "a detailed examination by a 
responsible manager on an area to determine the adequacy of 
controls and to identify and correct deficiencies and 
weaknesses." [Ref. 22:p. 1] This is a "do-it-yourself" type 
program, where managers assess the control system. Management 
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controls are in compliance with the program if they follow the 
objectives of internal controls: 


1. The Accounting control is responsible for safeguarding 
resources and assuring accuracy and reliability of 
information. 

2. The Administrative control assures adherence to laws, 
regulations, and policies and also promotes efficiency and 
economy. [Ref. 23] 

b. The Basic Program 

The basic program consists of six steps. 

(1) Assign Management Responsibilities . The 
Commanding Officer has overall responsibility for the program 
and must sign all reports, or in his/her absence, the 
Executive Officer may sign. All line managers perform 
assessments and reviews or document the reviews and testing of 
controls performed by audits, inspections or other reviews. 

(2) Segment the Organization . Segment the 
organization into meaningful assessable units. An assessable 
unit is any entity capable of being evaluated by management 
control procedures, for example, minor property. These units 
should relate directly to a responsible manager. 

(3) Risk Assessments . Risk assessments determine 

the susceptibility or vulnerability of a program to 

mismanagement due to fraud, waste or abuse. 

Assessments are a quick look at an assessable unit, based on 
an individual's (manager's) knowledge, experience, and 
personality. Yes, even personality because the 
applicability and degree of adequacy or acceptability varies 
with each individual. But given the same information the 
overall results of an assessment will generally fall in the 
same range of vulnerability. [Ref. 23] 
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The Vulnerability Assessment Form (Navcompt 
Form 2283) (see Appendix C for an example) analyzes the 
general control environment, the inherent risk and existing 
safeguards or controls. The Vulnerability Assessment Form is 
suggested but not mandatory. However, an alternative risk 
assessment must follow the intent of the 0MB guidelines. 

The alternative risk assessment is based on 
the results of audits, IG inspections, or reviews, and the 
manager's knowledge and experience. Specific documentation is 
required concerning how the alternative risk assessment was 
performed and what was considered. 

(4) The Management Control Plan . The Management 
Control Plan is a brief plan, updated annually, which gives 
the number of risk assessments, the number of reviews planned 
based on the list of assessable units, their risk ratings and 
how the evaluations are to be performed. This plan schedules 
control evaluations over a five-year period and is tied to IG 
inspections and annual audits to avoid duplication of efforts. 

(5) The Management Control Review . The Manage¬ 
ment Control Review is a detailed review examining the general 
control conditions, within the event cycles. An event cycle 
is "series of steps taken to get something done" [Ref. 
24:Encl, p. 1] or the steps used to accomplish the goals of 
the unit. This includes all the documents and activities 
needed to take a process from start to finish. [Ref. 23] It 
is conducted by the responsible manager to identify weak or 
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excessive controls and to provide appropriate corrective 
actions. Excessive controls are inefficient because the cost 
for maintaining the controls exceed the benefits achieved. 

All assessable units must be reviewed during 
the five year cycle regardless of the risk factor. Functions 
which have a high risk factor are required to be reviewed 
within the first two years of the five year cycle. A low or 
medium factor may or may not require a review during the first 
two years, depending on the directions from the chain of 
command. [Ref. 23] 

(6) The Annual Management Control Certification 
Statement . The Annual Management Control Certification 
Statement (see Appendix C) is sent to the next higher level in 
the chain of command documenting accomplishments, material 
weaknesses, the risk assessment report and management control 
plan. Proof of corrective actions taken must be attached to 
the statement. 

If the deficiency has not been corrected, a 
statement of dollar value, potential level of risk and adverse 
publicity which could result if the weakness continues must be 
attached. Milestones with estimated completion dates are also 
required. Any weakness or potential loss of more than five 
percent of current resources should be considered for 
reporting to the next level in the chain of command. Criteria 
used to determine the materiality of weaknesses are provided 
in Appendix D. [Ref. 23] 
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Appendix E is a selected list of DON material 
weaknesses reported to the Secretary of Defense in 1989. 
c. Regulations 

The Federal Managers' Financial Integrity Act 
requires the head of each agency to submit annual statements 
to the President and Congress on the status of internal 
controls. 0MB Circular A-123 prescribes government-wide 
policy for internal control systems in all government 
operations. 

The Under Secretary of the Navy establishes 
program policy for the Department of the Navy. A Review and 
Oversight Council exists, among other objectives, to ensure 
DON weaknesses are promptly corrected. The Naval Audit 
Service, and Naval Inspector General evaluate compliance with 
the program. 

For more detailed information concerning this 
program, consult SECNAVINST 5200.35B and OPNAVINST 5200.25B. 

3. Other Command Audits. Reviews and Cash Counts 

Although called audits, these are actually cash count 
verifications and should be of a surprise, irregular nature 
occurring not less than once each quarter. For these funds, 
managers can reduce the potential for fraud, waste and abuse 
by separating duties such as having different staff receive, 
count, record and deposit the money. 
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a. Imprest Fund 

The imprest fund cashier is an individual 
appointed by the Commanding Officer for the purpose of making 
authorized cash payments for materials and services and is 
responsible for maintaining custody of funds and filing 
periodic vouchers to account for and replenish the fund. 
Disbursing personnel cannot be cashiers. [Ref. 25] 

The NAVMILPERSCOMINST 7510.2A AND NAVCOMPT Manual 
Volume 4 provide direction for the imprest fund and audit 
requirements. 

b. Non-Appropriated Funds 

These funds include Morale, Welfare and Recreation 
(MWR) funds and Non-MWR funds such as the chapel funds, and 
bachelor quarters funds. 

OPNAVINST 1730.IB provides guidance for use of 
chapel funds. 

NAVMILPERSCOMINST 7510.2A provides guidance for 
Bachelor quarters funds and Morale, Welfare, and Recreation 
Funds. 

According to the Director for MWR Auditing, Naval 
Military Personnel Command (NMPC), the following agencies are 
available for the Commanding Officer's use for auditing the 
MWR program. 

Internal assets such as audit boards or qualified staff. 
A potential problem with these assets is the lack of 
independence to the command. Also, most commands use 
collateral duty personnel who are unfamiliar with the 
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accounting system and may not perform the audit with 
proficiency. 

Echelon Two Commanders routinely audit the program. The 
Commanding Officer can request an accelerated review 
outside the normal schedule. 

Naval Investigative Service can perform special investi¬ 
gations. This report will stay within the command if no 
criminal activity is suspected. 

Navy Audit Service (at cost to the command) or NMPC 
Fiscal Oversight can review weaknesses and disclose 
compliance with directives. 

The use of Certified Public Accounting firms (at cost to 
the command) require advance approval from the Auditor 
General of the Navy. [Ref. 26] 

This chapter discussed the topics of management 

control and auditing in the Navy. The next chapter will 

define audits, provide audit standards and discuss the audit 

process. 
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III. AUDITS AND STANDARDS 


This chapter defines audits, provides audit standards and 
discusses the audit process. 


A. AUDITS DEFINED 

An audit is the process by which an independent and 

competent person examines a sampling of the actual practices 

of the entity under study and compares these practices to the 

policies and directives established by higher authority and 

generally accepted accounting principles. As defined by DOD, 

...auditors independently and objectively shall analyze, 
review, and evaluate existing procedures, controls, and 
performance relating to organizations, activities, 
programs and functions; and shall present conditions, 
conclusions, and recommendations constructively in such a 
way as to stimulate or encourage corrective action. [Ref. 
ll:p. 4] 

1. Financial Audits 


A financial audit determines 

...whether the financial statements of an audited entity 
present fairly the financial position, results of 
operations, and cash flows or changes in financial 
position in accordance with generally accepted accounting 
principles, and whether the entity has complied with laws 
and regulations for those transactions and e '^ents that may 
have a material effect on the financial starements. [Ref. 
l:p. 2-1] 

The auditor's conclusions are expressed as an opinion 
of the entity's performance in relation to policies and 
principles. Therefore, the opinion cannot attest as to 
whether the financial statements are completely accurate, only 
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that they represent the actual performance of the 
organization. In conducting the audit, the auditor tests the 
control system and attempts to determine whether the financial 
statements are an accurate portrayal of events, whether the 
organization followed the generally accepted accounting 
procedures and general policies and laws. If the organization 
did these to the best of the auditor's knowledge and ability 
to test them, then the opinion will report that the statements 
are fair. 

2. Performance Audits 


Performance audits include economy and efficiency and 
program audits. Economy and efficiency audits include 
determining whether the entity is acquiring, protecting 
and using its resources economically and efficiently, the 
causes of the inefficiencies or uneconomical practices and 
whether the entity has complied with laws and regulations 
concerning matters of economy and efficiency. 

Program audits include determining the extent to which 
the desired results or benefits established by the 
legislature or other authorizing body are being achieved, 
the effectiveness of organizations, programs, activities, 
or functions, and whether the entity has complied with 
laws and regulations applicable to the program. General¬ 
ly, at the completion of a performance audit the auditor 
does not express an opinion on the overall level of 
performance. Rather, the auditor would report findings 
and conclusions on the extent and adequacy of performance 
and on specific processes, methods, and internal controls 
that can be made more efficient or effective. If poten¬ 
tial for improvement is found, the auditor would recommend 
appropriate corrective actions. [Ref. l:pp. 2-3—2-5] 


B. ESTABLISHING AUDITING STANDARDS 

Three standards boards enact the generally accepted 
accounting principles. The Governmental Accounting Standards 
Board (GASB) establishes accounting principles and financial 


28 






reporting standards for state and local government entities. 
The General Accounting Office (GAO) institutes accounting 
principles and financial reporting standards for the federal 
government. The Financial Accounting Standards Board (FASB) 
enacts accounting principles for nongovernment entities. 
[Ref. l:p. 2-1, Footnote 1] 

All auditors who conduct audits on government functions 
are required to follow the Government Auditing Standards as 
defined in the GAO Government Auditing Standards booklet (the 
yellow book). These standards are similar to those developed 
by the American Institute of Certified Public Accountants 
(AICPA) for nongovernment auditors. The standards are divided 
between general and specific, field work standards. Consult 
the yellow book for a full discussion of the standards. 

1. General Standards 

Four general standards detail the requirements of 
government auditors and nongovernment auditors performing 
audits on government functions. The first three standards are 
identical to the standards established by the AICPA; the last 
standard pertains only to GAO audits. 

The standards describe the independence of the auditor 
and the independence of the audit organization; the 
qualifications of the audit staff; the responsibility of due 
care; and the presence of quality control. 
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a. Independence 

Independence is the ability of the auditor to be 
impartial, and to be viewed as impartial by cogiiizant third 
parties, in collecting and analyzing information and preparing 
an opinion relating to the statements. An auditor or audit 
organization can be viewed as independent if no personal, 
external or organizational impairments exits. [Ref. l:pp. 3- 
8, 3-9] 

Personal impairments jeopardize the auditor's 
ability to make an impartial examination of the function. 
Such impairments can include a prejudicial attitude to the 
audited function or members of that organization; political or 
social biases due to loyalty to a specific organization; 
financial, professional or personal interest in the audited 
organization; and prior or current service with the audited 
organization. Policies enable the auditor and audit 
organization to identify any personal impairments which would 
mar the objectivity of the auditor's work and opinion. [Ref. 
l;pp. 3-8, 3-9] 

External impairments reflect on the ability to 
make a free and unbiased opinion. They result from factors 
outside the control of the audit organization such as the 
level of funding provided to the audit organization, the time 
provided for conducting the audit, interference from the 
audited agency on scope of the audit or transactions examined. 
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or any external interference which impacts the objectives of 
the audit. [Ref. l:pp. 3-8, 3-9] 


Organizational impairments affect the audit 
organization as a whole. The causes of these can be 
attributed to such pressures as whether the organization 
reports directly to the director of the audited function, 
whether its personnel are hired, promoted, or fired on merit 
or political coercion. [Ref. l:pp. 3-8, 3-9] 

b. Qualifications of the Audit Staff 

The combined staff should have the professional 

qualifications to competently perform an audit. This means 

that the audit organization as a whole must possess these 

qualifications not necessarily any one person. 

If an organization employs personnel, or hires outside 
consultants, with acceptable knowledge and skills in such 
areas as accounting, statistics, law, engineering, audit 
design and methodology, automatic data processing, public 
administration, economics, social sciences, and actuarial 
science, each individual staff member need not possess all 
these skills and knowledge. [Ref. l:pp. 3-1—3-2] 

In order for the audit organization to maintain 
its proficiency and technical competence, the GAO standards 
require a program of continuing education and training for all 
auditors assigned to the organization who perform audit 
activities and services. [Ref. l:pp. 3-1—3-2] 

c. Due Professional Care 

The auditor performs as a professional in all 
duties related to the audit. This includes but is not limited 
to defining the scope of the audit, ensuring the audited 
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entity understands the objectives of the audit prior to 
performing the audit, understanding the operations to be 
audited, choosing the appropriate methodology and tests used 
based on materiality or significance to the audit, the 
completion of the working papers, making inquiries concerning 
the expertise of external auditors or specialists assisting in 
the audit, rendering a sound opinion, and determining whether 
corrective action has been undertaken from previous audits if 
these affect the current audit. Each of these determines the 
quality of the final product. [Ref. l:pp. 3-1—3-2] 

This standard does not mean the auditor must make 
a perfect judgment or is infallible, nor does it imply the 
auditor assume extensive liability. [Ref. l:pp. 3-1—3-2] 
d. Internal Quality Control 

This applies to government auditors who are 
required to follow the GAO guidelines. GAO standards require 
an 


...external quality control review at least every three 
years by an organization not affiliated with the organiza¬ 
tion being reviewed. The external quality control review 
program should determine th?*t ••->^0 ■*'’=>•*■ ion' s internal 
quality control system is in place and operating 
effectively and established policies and procedures and 
applicable auditing standards are being followed in its 
audit work. [Ref. l;p. 3-18] 

The limits of an internal quality control system depend on the 
size of the firm, the nature of its work and the cost- 
benefit considerations given to a quality control program. 
[Ref. l:p. 3-18] 
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2. Specific Standards 

This section describes the supplemental field work 
standards for financial and performance audits. 

a. Field Work Standards For Financial Audits 

Financial field work standards have been developed 
by the AICPA. These are supplemented by the GAO Government 
Auditing Standards to assist auditors in government financial 
audits. 

(1) Planning . "Planning should include 
consideration of the audit requirements of all levels of 
government." [Ref. l:p. 4-1] This standard requires auditors 
to determine the final users of the audit and plan the audit 
to meet their legal and regulatory requirements. 

(2) Compliance Tests . Not only should the 
auditor test compliance with the laws, but also test how not 
complying with the laws and regulations affects the financial 
statements or the results of the audit. The auditor should be 
predominately concerned with those laws and regulations which 
directly and materially affect the financial statements. 
[Ref. l:p. 4-1] 

The auditor should be cognizant of areas 
susceptible to fraud or other illegal acts and design audit 
tests to detect those which could have a material affect on 
the financial statements or the report of a financial audit. 
As part of the general standard of exercising due care, the 
auditor should extend the scope of the audit when evidence 
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indicates possible illegal acts or terminate the audit 
completely, turning over the evidence to criminal 
investigators. [Ref. l:p. 4-1] 

(3) Working Papers . These provide evidence of 
the audit work performed and the basis for the opinions 
expressed in the report. 

(4) Internal Control Structure . The auditor 
needs a sufficient understanding of the internal control 
structure in order to plan the audit and associated tests. 
With financial audits, the auditor is concerned only with 
those controls which apply to the financial records or which 
the auditor uses in audit tests. [Ref. l:p. 4-1] 

b. Field Work Standards For Performance Audits 

(1) Planning . Planning includes coordinating the 
activities with other agencies which may be involved to 
prevent double work and to centralize aspects of the work, 
such as the final report. A well-planned audit helps 
guarantee the costs associated with the audit are outweighed 
by the benefits attained. Initial surveys are recommended to 
adequately plan the audit scope. [Ref. l:pp. 6-6, 6-7] 

Audit scope is the boundary of the audit 
including the audit subject and performance standards. 
Objectives are what the audit attempts to accomplish and 
should be clearly and concisely documented. Methodology 
includes the tests, data gathering process and evidence 
collected during the course of the audit to show that the 
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objectives and scope have been accomplished. Performance 
standards shou d be reasonable, relevant and attainable. 
[Ref. l:pp. 6-6, 6-7] 

An audit program is developed for each audit. 
The audit program details the work among supervisors and 
staff, and provides the methodology and procedures to be used. 
As a minimum, audit programs should include: 

- Introduction and background: Information should be 
provided about the legal authority for the audited organi¬ 
zation, program, activity, or function; its history and 
current objectives; its principal locations; and similar 
information needed by the auditor to understand and carry 
out the audit program. 

- Objectives of the audit: The objectives should be 
clearly stated. 

- Scope of the audit: The scope should be clearly 
described. 

- Audit methods: The methodology should be clearly 
described, and for most audits, it is desirable to include 
suggested steps and procedures, and sampling plans for the 
auditors to follow.... 

- Definition of terms: Any known unique terms used by 
the audited entity should be defined or explained. 

- Special instruction:....This section of the program 
may be used to list the responsibilities of each audit 
organization, such as preparing audit programs, conducting 
audit work, supervising audit work, drafting reports, 
handling auditee comments, and processing the final 
report. 

- Report: The audit program should set forth the 
general format (if not included in organization audit 
policy and procedures) to be followed in the audit report 
and cite, to the extent possible, the types of information 
to be in it. [Ref. l:pp. 6-6, 6-7] 

(2) Supervision . Supervision varies with the 
staff members' level of experience and is documented in the 
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working papers. This includes whether the objectives were 
achieved, the audit standards and audit program were followed, 
and whether the working papers substantiate the audit 
findings. Providing on-the-job training and continuing 
education are also included in this standard. [Ref. l:p. 6-9] 

(3) Compliance Tests . 

An assessment is to be made of compliance with applicable 
requirements of laws and regulations when necessary to 
satisfy the audit objectives....Auditors should design the 
audit to provide reasonable assurance of detecting abuse 
or illegal acts that could significantly affect the audit 
objectives....Auditors should be alert to situations or 
transactions that could be indicative of abuse or illegal 
acts. [Ref. l:p. 6-9] 

The auditor decides which laws and regulations pertain to the 
audit as well as those which will have a vital influence on 
the objectives. The audited entity is responsible for 
providing the pertinent laws and requirements for the auditor. 

[Ref. l:p. 6-11] 

(4) Assessment of Internal Controls . This is 
required, if needed, to satisfy the audit objectives. The 
reasons and tests used to evaluate internal controls depend on 
the audit objectives. Not all audits will require an 
assessment of the controls. [Ref. l;p. 6-13] GAO Government 
Auditing Standards necessitate examining the controls if the 
audit objectives require: 

testing the adequacy of particular internal controls. 

verifying the adequacy of the process for carrying out a 

particular mission or action. 

assessing unsatisfactory performance. [Ref. l:p. 6-13] 
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(5) Evidence . Evidence has four categories: 
physical, documentary, testimonial and analytical. 

Physical evidence pertains to the direct 
observation or inspection by the auditor. This can include 
observing events such as counting inventory; inspecting 
charts, graphs, maps, buildings etc., or other physical 
documentation of property; and observing people in action. 
This type of evidence is more reliable and valid than that 
which is obtained indirectly. [Ref. l:pp. 6-16, 6-17] 

Documentary evidence relates to the files of 
the organization reflecting performance. These are the memos, 
letters, accounting records, etc. The original documents are 
considered more reliable than copies. [Ref. l:pp. 6-16, 6-17] 

Testimonial evidence comes from interviews 
and correspondence written directly to the auditing service. 
If the evidence is significant to the audit, the auditor 
should also collect supporting information regarding the 
statements anc. the reliability of the source. The testimony 
can be considered valid and reliable when the person can speak 
without reprisals. [Ref. l:pp. 6-16, 6-17] 

Analytical evidence applies to the 
calculations, logic, and correlation of the information 
received. [Ref. l:pp. 6-16, 6-17] 

Once the auditor has the evidence, it must be 
tested for sufficiency, relevance and competence. 
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- Sufficiency is the presence of enough factual and 
convincing evidence to support the auditors' findings, 
conclusions, and any recommendations. Determining the 
sufficiency of evidence requires judgment. When 
appropriate, statistical methods may be used to establish 
sufficiency. 

- Relevance refers to the relationship of evidence to 
its use. The information used to prove or disprove an 
issue is relevant if it has a logical, sensible relation¬ 
ship to that issue. Information that does not is irrele¬ 
vant and therefore should not be included as evidence. 

- To be competent, evidence should be valid and 
reliable. In evaluating the competence of evidence, the 
auditors should carefully consider whether reasons exist 
to doubt its validity or completeness. If so, the 
auditors should obtain additional evidence or reflect the 
situation in the report. [Ref. l:p. 6-17] 

The auditor can surmise the evidence is competent if it comes 

from a source independent of the audited entity; or if the 

internal control structure is strong. [Ref. l:p. 6-17] 


C. AUDIT PROCESS 

Four stages occur in most audits, whether they are 
performed by the in-house auditors or audit agencies: 
planning, survey, verification and reporting. 

1. Planning Stage 

Preliminary research and preparation for an audit 
could best describe this phase. To control costs and to 
ensure an audit which will assist management effectively, an 
audit plan is developed. Limited value is attributed to even 
superbly conducted audits which provide meager or no benefits 
to management. In addition, audits which are broadly scoped 
cannot control costs effectively thereby diminishing the 


38 






results of the audit report. With increasing attention 
focused on government spending, it behooves the audit agencies 
to develop sound audit plans which can justify when and why 
certain areas are planned and audited or not planned and not 
audited. [Ref. 27:Ch. 5, p. 3] 
a. Justification 

The DOD Internal Audit Manual provides the 
following causes for justifying and prioritizing audits: 

1. Sensitivity. The sensitivity of a program or system 

to the mission of an organization and the importance of 
that mission to the overall mission of its parent 
organization are important considerations. Other 

considerations include whether an area is of high interest 
to the head of the Department or organization or whether 
poor performance in an area could cause severe 
embarrassment to the Department or adversely impact on its 
relations with Congress. 

2. Risk. The adequacy of internal control systems and 
the vulnerability of an area to fraud, waste, abuse or 
mismanagement is the major consideration in this area. 
Also, the newness of, or major changes in, programs and 
systems could increase the risks. 

3. Audit Experience. Give a higher rating to an audit 
area that has a history of major deficiencies than to an 
area that has experienced only minor deficiencies in the 
past. Be sure to consider the results of other evalua¬ 
tions such as inspections, investigations and program 
reviews, along with the results of the most recent reviews 
by the audit activity, other DOD audit organizations, U.S. 
General Accounting Office (GAO), and commercial firms 
performing audit work on a contractual basis. 

4. Financial Impact. Identify the current or potential 
dollars involved in the programs, system or function. 
This can be measured in various ways such as value of 
assets or amount of funding. 

5. Time Since Last Audit. Consider the date of the last 
audit or comprehensive inspection and assign higher 
ratings to those with longer elapsed times since the last 
audit or comprehensive inspection. 
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6. Management Request. Assign additional rating points 

when management requests an audit of the area. [Ref. 

27:Ch. 5, pp. 5-6] 

b. Audit Plan 

Planning and conducting the audit is the auditor's 
responsibility. The audit plan contains: 

- the audit objectives and scope. 

the background of the proposed activity. 

- written communication with all interested parties 
including the activity to be audited. 

resources required to perform the audit adequately. 

- on-site surveys planned to develop familiarity of the 
program, to identify areas to emphasize, and to invite 
comments from the activity. 

approval of the work plan. 

coordinating the plan with other audit and review 
agencies to ensure similar audits are not planned or 
currently running. [Ref. 27:Ch. 2, p. 8] 

2. Survey Stage 

The survey stage is the refinement stage. For the 

Naval Audit Service, this phase encompasses approximately 30 

percent of the total audit time. [Ref. 28] During this 

phase, the audit team determines whether sufficient evidence 

exists to perform an audit and attain monetary benefits in 

excess of costs. Approval to continue with the audit process 

is assigned to senior management based on the reports from the 

field auditors. [Ref. 27:Ch. 8, p. 4] This phase requires: 

familiarity with the program, planned area, and its 
policies and procedures. It provides auditors the 
opportunity to interview management for suggestions and 
comments, to identify areas of weakness or corrective 
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actions taken from previous inspections or audits, and 
to identify potentially significant findings for 
further study during the verification phase. This 
phase also develops or refines audit objectives and the 
scope of the work including site selection. [Ref. 
27:Ch. 8, p. 4] 

the decision to proceed with the audit. 

The audit program is then developed. The program v.ill 
include the revised or established audit objectives; special 
instructions and definition of terms; background of the 
function to be audited including but not limited to location, 
mission, policies and procedures, and noted areas of 
deficiencies in the control program; purpose and scope of the 
audit as well as methodology, and the format and content of 
the report. [Ref. 27:Ch. 8, p. 4] If the audit program is 
effective, standardized procedures will then exist for 
multilocation audits. [Ref. 27:Ch. 8, p. 4] 

3. Verification Stage 

The actual audit field work occurs during this phase. 
The audit team provides an entrance letter to the component 
head, detailing the objectives and scope of audit and the 
period of time which the audit will cover. This letter 
provides ample notification for the entity to prepare for the 
audit. The auditors will request an initial interview with 
the command in which they will address their objectives and 
any concerns the command may have, including noted weaknesses 
which are being corrected, prior to beginning the actual work. 
No entrance letter is sent for cash counts or similar audits 
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where surprise is essential to the audit. For all audits, 
management will be advised when objectives are modified and 
when the audit progresses through each stage. 

During this phase, the auditors collect the evidence 
needed to accomplish the audit objectives and to develop 
conclusions and opinions concerning the audited entity. Some 
of the evidence collected includes investigating prior audit 
recommendations and testing for corrective action. The prior 
audits need not have been performed by the same agency. Any 
previous audit is eligible. [Ref. 27:Ch. 8, pp. 5-8] 

The auditors are responsible for developing their 
potential findings and recommendations as early in the audit 
as possible and discussing these with the audited entity's 
officials, before they are in the formal draft. The findings 
must relate to the objectives. If management takes corrective 
actions on the potential findings, this action will be 
reflected in the report as well as any corrective actions 
taken prior to the audit. [Ref. 27:Ch. 8, pp. 5-8] 

A draft report will be presented to the activity prior 
to the end of the audit or within 60 days of completion of the 
field work. This report clarifies any discussions with 
management, provides management the opportunity to refute 
claims of benefits associated with the findings and in the 
process reduces the possibility that management will reject 
the report. [Ref. 27;Ch. 8, pp. 5-8] 
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The exit conference is management’s final occasion to 
discuss disputed matters with the auditors before the formal 
draft is written. If this conference occurs before management 
has a chance to see the draft report, another conference will 
be offered, if desired. [Ref. 27;Ch. 8, pp. 5-8] 

The final step in this process is the post-audit 
critique which is designed for management to provide feedback 
for improving audits of the type just performed. [Ref. 27:Ch. 

8, p. 8] 


4. Reporting Phase 

The audit report is the formal written document which 
describes the results of the audit process. Included in this 
document are the auditors' opinions and recommendations for 
improving material deficiencies. All audit reports follow the 
standards established by the AICPA and the GAO Government 
Auditing Standards. 

a. Financial Audit Reporting Standards 

The first four standards for reports of financial 

audits and financial related audits require a statement that: 

the audit was made following generally accepted govern¬ 
ment auditing standards (GAGAS). This refers to the 
standards described in the yellow book. [Ref. 27:p. 
12 - 2 ] 

a test was conducted for compliance with laws and 
regulations. The compliance statement will be in the 
form of a positive or negative assurance. A positive 
assurance indicates the test was performed and there 
appears to be compliance with the laws. A negative 
assurance indicates that nothing appears to indicate 
noncompliance in the items not tested. This statement 
on compliance will indicate whether illegal activities 
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identified through the audit could result in criminal 
prosecution. A noncompliance statement will be issued 
if necessary. [Ref. 27:p. 12-2] 

concerns the auditors' assessment of the internal 
control structure. This statement will detail the 
scope of the work involved to garner an understanding 
of the control environment, tests of the controls and 
the report of the condition of the controls. 

An assessment need not be made but must be 
reported, if: 

a. uhe size of the audited organization is small, 

b. the control structure is so weak that the auditor 
had to rely on other tests, 

c. it was more efficient to conduct other tests, or 
the audit objectives did not require an evaluation 
of the internal controls. [Ref. 27:p. 12-2] 

some information which forms the auditors' opinions may 
be prohibited by law from disclosure. If this is the 
case, the auditor will describe the nature of the work 
and the basis for the nondisclosure in the audit 
report. [Ref. 27:p. 12-2] 

The fifth standard covers distribution and 
timeliness of the audit report. Timeliness, for DOD, means 
within 120 days following the draft report. [Ref. 27:p. 12-2] 
Generally, unless the report is classified for security or 
ethical reasons, it is made available to all interested 
parties for inspection. 

b. Performance Audits 

Performance audit reports will include the 
statements as described above on compliance with GAGAS, 
assessment of internal controls, compliance with laws and 
regulations, disclosure and distribution requirements. 
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In addition the report will have a statement 
describing the audit scope, objectives and methodology. Audit 
findings and conclusions should be relevant, competent and 
sufficient. The findings and conclusions will be clearly 
stated. Any background information for which an interested 
third party may need to understand the report will also be 
included. [Ref. l:p. 7-15] 

Where weaknesses and deficiencies are noted, the 
auditor will provide the cause of the problem identified and 
supporting evidence. Beneficial and practical recommenda¬ 
tions when required by the audit objectives will be made if 
corrective action will significantly affect the organiza-tion. 
Any uncorrected actions from previous audits will be reported. 
Auditors are advised to address their specific recommendations 
in a constructive, performance-directed manner to those 
officials capable of taking action. [Ref. l:p. 7-15] 

Performance audit reports will p.ovide for 
appropriate remarks by accountable officials on action taken 
or contemplated concerning the findings and conclusions. The 
auditor will normally request these remarks in writing to 
avoid possible misinterpretation. [Ref. l:p. 7-15] 

The report will note if the audit uncovered any 
management achievements, especially if these applied to other 
areas of the audited entity, "inclusion of such 
accomplishments may lead to improved performance by other 
government organizations that read the report." [Ref. l:p. 
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7-11] Any areas requiring further study but not associated 
with the audit objectives under examination, will also be 
noted in the report. [Ref. l:p. 7-15] 

The performance audit report will be "complete, 
accurate, objective, and convincing, and be as clear and 
concise as the subject matter permits." [Ref. l:p. 7-12] 
Complete refers to the information provided, the perspective 
of evidence to the findings, and if required, supporting 
documentation for the reader to correctly understand the 
organization's performance. An accurate portrayal refers to 
ethical and professional work. An audit agency maintains 
integrity in its working papers if evidence is relevant and 
competent to the audit scope, objectives and methodology. 
[Ref. l:p. 7-15] 

Objectivity is the impartial manner in which the 
audit is conducted, the facts presented, and the report 
written. A professional report will keep findings and 
conclusions in perspective. Behavior modification is always 
the reason for the recommendations. Therefore, the auditor 
will address the report in a constructive manner so as to be 
helpful. [Ref. l:p. 7-15] 

Convincing, clear and concise requires the auditor 
to present the report in a manner which is easy to read, whose 
conclusions follow logically from the facts and audit 
objectives, providing any necessary supporting documents such 
as charts or graphs which will make it easier to understand. 
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The report will be long enough to cover the audit without 
being redundant; a complete, concise report will receive 
greater attention. [Ref. l:p. 7-15] 
c. Follow-up 

The auditors check for corrective actions on known 
findings and recommendations from previous audits which could 
affect the findings of the current audit. During this check, 
they also ascertain whether optimum benefits were attained in 
a timely manner. [Ref. l:p. 7-15] 

Follow-up for auditors also occurs after their 
report is issued. They verify management's responses are m.ade 
within 60 days of the draft report or 60 days following 
release of the final report. If a deficiency requires 
immediate action, the timeframe for responses will be 
indicated in the report. The second part of follow-up 
requires the auditor to review the management's responses 
according to DOD directives. Management is compelled to 
concur or not concur with each audit finding, recommendation 
and monetary benefit. The audited entity may indicate whether 
alternative action is more appropriate and provide their 
proposal. Management is also compelled to provide any 
corrective action taken and a plan of action on those findings 
and recommendations where corrective action has not been 
taken. The plan of action will also indicate estimated dates 
of completion and monetary benefits anticipated. [Ref. l:p. 
7-15] 
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Specific guidelines for resolving disputes are 
provided within DOD Directive 7650.3. 

This chapter defined audits, provided audit 
standards and discussed the audit process. The next chapter 
will discuss practical suggestions for managers to prepare for 
and participate in audits or reviews. 
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IV. PRACTICAL GUIDELINES FOR A SUCCESSFUL AUDIT 


This chapter discusses practical suggestions for managers 
to prepare for and participate in audits or reviews. 


A. PREPARING FOR AN AUDIT OR INSPECTION 

Once notified, the following steps are recommended. 

Usually the manager will have several months notice of a 

pending audit or inspection. The manager should: 

Review the areas of special interest issued in the audit 
plan, and understand the objectives and scope of the 
audit or inspection. Will it be an activity level 
compliance audit or will its focus be narrowed to a 
specific program? If it will be a multi-location audit, 
the manager will require more specific preparation. 

Review prior inspection and audit findings for areas of 
potential weaknesses, since auditors look at results and 
recommendations from previous audits. If these have been 
reported corrected but the deficiencies still exist, 
managers m;:st take immediate action to correct the 
situation. 

Prioritize the discrepancies requiring corrective 
action according to the level of risk and vulnerability 
to tne mission of the command. Two audit findings are 
considered the worst kind: repeat audit findings when 
corrective action was reported earlier, and new audit 
findings identifying a weakness of which the manager was 
unaware. 

Perform a mini-audit, examination or review on the 
function. Is there compliance with the required 
standards, directives, etc.? If the Management Control 
Review has been conducted correctly, there should be few, 
if any, surprises. 
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B. PARTICIPATING IN AN AUDIT 


1. Professionalism and Cooperation 

Cooperation in attitude is extremely important. The 
manager should assume a professional stance. 

Be helpful. Assist the auditor with access to 
requested information. However, limit access to the requested 
information only, so weaknesses can be attributed exclusively 
to that file. 

Provide status on apparent deficiencies and any 
corrective action which has been taken. If the problem is 
obvious, the auditor will find it anyway. Ask for advice on 
how to correct problem areas, especially during survey audits. 
The auditor's job is to assess the function and make 
corrective recommendations. 

The Naval Audit Service indicates some managers have 
been known to conceal vital information to an audit only to 
turn it over during the exit conference. [Ref. 28] Managers 
maintain their credibility with the auditors if they are 
honest and are not concealing information. When the manager 
loses credibility, the auditor relies on evidence obtained 
elsewhere. 

Provide an area for the auditor to work uninterrupted. 
Since the auditor is unfamiliar with the physical 
organization, the manager should provide a layout of the 
building. 
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Assist in scheduling meetings and interviews with key 
personnel. This also requires the manager to have key 
personnel available during the audit, scheduling leave and 
travel appropriately. 

Ensure the staff has been trained to comply with 
directives and instructions so the auditors receive the same 
information from all. Other ways to participate include 
asking questions of the auditors to clarify information or to 
understand the work and tests performed. Keep the chain of 
command informed of the progress and any important develop¬ 
ments or findings which could reflect adversely on the 
command. 

2. Auditee*s Bill of Rights 

An audited organization has certain rights during an 

audit. 

a. Right 1 

To know the scope, schedule and objectives of the 
audit or any changes to these. The auditor is required to 
provide this information at the entrance interview. 

b. Right 2 

To conduct its work with minimal interference. 
The audited entity should provide a point of contact if the 
auditor requires assistance outside the interview schedule. 

c. Right 3 

To ask questions of the auditor or request 
clarifying information pertaining to the audit at any time. 
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The organization has the right to understand the audit process 
including the methodology, tests and findings. 

d. Right 4 

To read the report before final release. This is 
extremely important. If there are disagreements, the manager 
should make them known. Indicate concurrence or non¬ 
concurrence to each finding, in writing. Major claimants have 
been known to mark budgets based on a manager's concurrence 
with the findings. If the manager does not concur, provide 
supporting evidence for the non-concurrence. This is the 
manager's last opportunity to question the findings and tests. 
[Ref. 29] 

3. Audit Follow-up 

Design a tickler system to track each finding until 
corrective action has been taken and verified. This tickler 
system furnishes information which indicates the 
organization's position on the findings, corrective action 
taken and whether the actions corrected the noted 
deficiencies. It also indicates monetary benefits achieved 
and how these correspond to the audit report. Finally, the 
tickler file provides a plan of action including dates for 
corrective action and completion of those areas not readily 
corrected. The tickler file remains open until the corrective 
actions have been taken and confirmed or verified. 

The tickler file should be made available for all 
interested entities to perform new audits, reviews, etc.. 
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based on the status of the audit report. All documentation 
remains in the follow-up files for further reviews. [Ref. 
30:p. 6] 

C. USING AUDIT AND REVIEW ASSETS EFFECTIVELY 

Judicious use of internal assets, such as former internal 
review personnel, accountants, or management analysts, 
promotes better management. When you ask functional leaders 
to report on their areas, you get what you inspect. [Ref. 31] 
Managers are reluctant to report weaknesses for which they 
cannot correct promptly. 

Internal assets, audits and reviews keep people honest. 
If they know they will be inspected, they are more likely to 
follow established guidelines. 

Internal assets can also investigate Commanding Officer's 
hot-line issues. If these issues are of significant concern 
or dollar amounts, the Commanding Officer can address them 
further in economy and efficiency reviews, or audits. 

Whether to perform economy and efficiency reviews on a 
periodic basis or a' the beginning/end of tours is a 
management decision. Some prefer the periodic basis which 
provides the manager the opportunity to correct the problems 
before detaching. They also feel that since other employees 
are still in that functional organization, new standards can 
be developed at any time. Others prefer the entrance/exit 
review as a measure of the efficiency and effectiveness of the 
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outgoing manager, and for establishing a new set of standards 
for the new manager to follow. 

D. MANAGEMENT CONCERNS 

Most commands report the discrepancies noted in audits are 
the result of not having adequate numbers of staff or time to 
do everything which is required. Fraud, waste, abuse or 
mismanagement are not the typical culprits. The manager makes 
the decision by default on which requirements are more 
important and which can be relegated to second place until 
time permits. Most interviewees said they have good people 
doing a good job the way they were trained. The training and 
time to perform the job could be improved. 

A second concern affects the topics audited. The managers 
feel the topics are not necessarily the big dollar items, such 
as those which have the largest budgets but are more often the 
result of political and media events. Often, the small funds, 
such as Morale, Welfare and Recreation (MWR) funds and chapel 
funds receive the greatest attention due to their high 
visibility and risk status since they handle cash 
transactions. According to one interviewee, five percent of 
the audits are spent on a function which uses 60 percent of 
the budget, and 30 to 40 percent of the audit time is spent on 
chapel funds and MWR. Additionally, directives are sometimes 
behind the times, as in MWR requirements. However, these 
outdated directives are the only source for auditors to rely 
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upon when checking compliance. [Ref. 31] Other interviews 
provided similar information. 

E. CONCLUSION 

Taxpayers are becoming increasingly concerned with how the 
government spends its money, particularly in defense-related 
areas. With constant discussions concerning the spiraling 
budget deficit and resultant interest payments, the media and 
taxpayers are demanding closer scrutiny of the budget and how 
government funds are spent. 

Congress attempts to control wasteful spending through 
budget restraints. For instance, audit reports generally 
recommend various savings and benefits. Theoretically, if the 
recommendations are enacted by the auditee, budget savings 
should accrue. However, if these recommendations are not 
implemented. Congress can restrict the budget to the amount of 
the projected savings under the assumption that an 
efficiently-managed program would require less funding. 
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APPENDIX A 


COMMON/RECURRING DISCREPANCIES FOUND 
DURING COMMAND INSPECTIONS 


This is an abbreviated list of recurring items discovered 

during command inspections by major claimants. 

Failure to maintain an active energy conservation and 
awareness program to meet CNO energy management 
objectives by not taking advantage of energy reduction 
projects, conducting quarterly energy conservation 
committee meetings, developing an energy improvement plan 
and instituting an awareness program. 

Failure to implement a Military EEO Program and ensure 
that Navy Rights and Responsibilities Workshops are 
conducted. 

Failure to develop adequate performance standards and 
elements in that they are too vague or general, unrelated 
to duties described in position descriptions, not 
measurable, or address conduct rather that performance. 

Failure to implement an effective Internal Controls 
Program wherein reviews are properly documented. 

Failure to adequately test internal controls while 
conducting Management Control Reviews (MCRs). 

Failure to establish adequate controls for monitoring the 
use of overtime. 

Failure to comply with Occupational Safety and Health 
training requirements for all categories of personnel. 

Failure to establish a strict key and lock control 
program. 

Failure to develop and publish a comprehensive Physical 
Security Plan. 

Failure to develop and/or maintain an updated Oil Spill 
Prevention Control and Countermeasure Plan for fuel 
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storage facilities to identify potential sources of 
petroleum spills. 

Failure to initiate proper tracer action on inbound 
household goods shipments which do not arrive by the 
required delivery date in order to determine current 
location, status, and new estimated time of arrival. 

Failure to establish adequate controls for disposal proof 
of shipment/proof of delivery processing in order to 
account for transfer of shipments to the Defense 
Reutilization and Marketing Office (DRMO). 

Failure to process interfund billings in a timely 
manner. [Ref. 32] 
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APPENDIX B 


NAVAL AUDIT SERVICE 

The Naval Audit Service is divided into four directorates: 
Management Resources Directorate; Plans and Policy 
Directorate; Audit Operations Directorate; and Management 
Consulting Directorate. Audit coverage is divided into four 
regions: Western, Northeast, Capital and Southeast. In 
addition to the Navy Audit Service Headquarters and the 
Regional Headquarters, auditors can be found in the following 
locations: 

- SYSTEMS COMMANDS AND HEADQUARTERS ACTIVITIES. 

- INVENTORY CONTROL POINTS. 

- SHIPYARDS. 

- AVIATION DEPOTS. 

- SUPPLY CENTERS. 

- FINANCE CENTERS. 

- MARINE CORPS BASES. 

- RDT&E/ENGINEERING ACTIVITIES. 

With a FY-1990 budget of $28.8 million, 554 civilian 
personnel (primarily in the GS/GM-511 Auditor series), 
generated about 700,000 direct audit hours. 

The Naval Audit Service was heavily criticized by GAO and 
DOD IG in 1986-7 for recommending $6 million in potential 
benefits while spending $26 million a.id lacking documented 
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supervision and quality control. Designating military 

officers as deputy auditor general and regional office 

directors created the perception of reduced audit independence 

and a potential conflict of interest with future supervisors. 

Senior Navy Auditor concerns centered on the considerable 
amount of resources expended to complete audit guides and 
prepare workpapers for areas which contained little or no 
audit potential. The Navy Auditor General dedicated 29 
percent of available audit hours in FY86 to single-activity, 
compliance audits. [Ref. 3:p. 12-14] 

As a result of the GAO findings, the Naval Audit Service 
restructured itself, providing extensive supervision and 
quality control. Military directors were replaced with 
SES/GM-15 civilian directors to counter possible conflict of 
interest and audit independence concerns. 

Standardized audit programs were discontinued and a unique 
audit program was designed for each audit. Mission effective¬ 
ness and efficiency replaced compliance as the primary audit 
objective. The by-products could be savings and readiness. 
Savings are defined as: 1) recurring (annual recurring) or 
non-recurring (one time savings, such as when the program is 
canceled), and 2) collections from overpayment. [Ref. 18] 

The Naval Audit Service also developed an audit-by¬ 
objectives approach. This management technique forces 
auditors to attend to the objectives throughout the audit 
process, refining them when necessary. It requires a 
conscious decision to progress to each stage of the audit 
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process. The basic elements of the audit-by-objectives 
approach entail: 

Establishing specific audit objectives and, if 
appropriate, a general a^^dit objective for every audit. 

Refining the audit objectives during the planning and 
survey phases of the audit based on information gathered 
during each phase. 

Making a formal decision to either continue or curtail 
the audit at the end of the planning phase and the survey 
phase before beginning field verification. 

Developing an audit plan to achieve the established 
audit objectives and produce potential findings and 
recommendations. 

Structuring the audit approach to determine whether a 
major problem exists, the extent of the problem, the basic 
cause of the problem, and to formulate workable solutions. 

Reevaluating the audit approach during the early stages 
of verification. 

- Effectively controlling the audit with a series of go 
or no-go decision points before beginning each audit phase. 
High level audit management shall be involved at the 
decision points at the start of the audit, at the end of the 
survey phase, and at the end of the field verification. 

Summarizing audit results in the form of conclusions 
about the general objective, if there is one, and about each 
specific objective. [Ref. 27:pp. 3-4] 


A. AUDIT PLAN 

The audit plan generally covers current high interest 
issues. [Ref. 16] A limited selection of the 1990 audit plan 
is included in Section B of this appendix. 

The Naval Audit Service also performs an independent 
appraisal as part of its annual audit plan to determine 
whether the Management Control Program and policies are 


60 



followed, and identified weaknesses are adequately corrected. 
According to the Director for Audit Policy at the Naval Audit 
Service, the Management Control Program is assessed twice. 
Each program audit determines whether the Management Control 
Program is accomplishing its goal and how the program affects 
the audit results. The second assessment occurs when the Navy 
reports its annual weaknesses. Auditors visit sites and look 
at opinions and weaknesses to ensure nothing is concealed or 
hidden. [Ref. 18] 


B. NAVAL AUDIT SERVICE INTERNAL AUDIT PLAN 

This is a selected list of planned or ongoing audits for 
1990. 

Hazardous Waste Management . 

Objectives: (1) evaluate hazardous waste management as 

related to transportation, treatment, reuse, recycling, and 
disposal; (2) evaluate accuracy of hazardous waste 

generation reporting; (3) evaluate hazardous material 
acquisition and storage practices; (4) determine adequacy 
of hazardous waste management training, staffing, and 
funding; and, (5) evaluate the ability of the Navy to 
effectively comply with federal, state, and local 
jurisdictional requirements. 

DON Management Control Program. Accounting Systems Review 
Process, and the Efficiency Review Program . 

Objectives: (1) determine the reasonableness and propriety 

of the FY 1989 DON Management Control Certification 
Statement, (2) assess the basis for reporting accounting 
systems in substantial compliance with prescribed principles 
and procedures, and (3) determine the extent of the 
implementation of the DON Efficiency Review Program. 

Follow-up on Audit of Navv Budget Clearing Accounts . 
Objectives: determine if (1) Navy management took action in 

response to our prior audit of Budget Clearing Accounts, and 
(2) those actions corrected the reported deficiencies. 
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Development and Implementation of the Automated Standard 
Civilian Payroll System fNAVSCIPS) . 

Objectives: determine whether (1) the NAVSCIPS project 
objectives ar being effectively and efficiently 
accomplished, and (2) the requirements for NAVSCIPS can be 
economically justified. 

Budgeting and Contracting for Navv Base Operating Services . 
Objectives: determine (1) if budgeted funds adequately 
support operational requirements, (2) if contract award 
procedures are proper, (3) if work and services billed are 
actually performed, (4) if contractors are properly paid, 
and (5) if the contract administration function is 
otherwise properly performed. 

Manage-to-Pavroll in the Navv . 

Objectives: determine (1) if Manage-to-Payroll is a viable 
method of controlling civilian payroll costs, (2) if 
commands have adequately implemented Manage-to-Payroll, and 
(3) if personnel resources are managed efficiently and 
effectively under the program. [Ref. 33] 


62 






APPENDIX C 


EXAMPLES OF VULNERABILITY ASSESSMENT 
FORM AND BASIC CERTIFICATION LETTER 


The following pages provide examples of the vulnerability 
assessment form and format for the basic certification letter 
as suggested in SECNAVINST 5200.35B, dated 25 March 1988. 
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VULNERABILITY ASSESSMENT FORM 


t onMMOAnoN 


X. OiMUMZAnON coot: 


3. PROGRAM' 
FUNCTION/ 
ACTIVITY 
IMMfSMLIUNrn 


»> 


cc 


o 

u 


X 

lU 

o 


4 . EMPHASIS ON INTERNAL CONTROLS: 

MAJOW EMPHASIS_ 


MODERATE EMPHASIS 


MINOR emphasis 


s. 


COVERAGE BY WRITTEN PROCEDURES: 

SPECIFIC guidance W/ LITTLE OR NO 
DISCRETION_ 


FLEXIBLE guidance W/ SIGNi>^iCANT 
DISCRETION 


NO WRITTEN PROCEDURES 


SPECIFYING GOALS AND MEASURING 
ACCOMPLISHMENTS: 

NOT applicable 


goals-objectives formally established 
AND MONITORED 


GOALS-OBJECTIVES use INFORMALLY OR 
Wi little FOLLOWUP 


GOALS-OBJECTIVESNEEDED BUT 
NOT ESTABLISHED 


01 


(31 


(51 




O) 


(51 


(I) 


(31 


(5) 


7. ADEQUACY OF CHECKS AND BALANCES: 

notapplcable 


ADEQUATE 


NEEDS IMPROVEMENT 


RE(XIIRED BUT TOTALLY LACKING 


ADP USED FOR REPORTING OR 
OPERATIONAL DATA: 

NOTAPPLCABLE 


DATA RELIABILITY fTIUBLINESS. ACCURACY) AND 
SECURITY ARE SATISFACTORY 


data reliability C)R SECURITY NEEDS SOME 
IMPROVEMENT 


DATA RELIABLITYfSECURITY IS AMAJOR PROBLEM 


PERSONNEL RESOURCES 

ADEQUATE NUMBER OF (JUALIFIED PERSONNEL 


ADEQUATE NO OF PERSONNEL BUT iOME~ 
THAINING REQUIRED 


INSUFFICIENT NO OF PERSONNEL OR MAJORITY 
Of staff LACKS QUALIF OR NEEDED TRAINING 


(II 


(31 


(51 


(I) 


(31 


(51 


(II 


(3) 


(51 


K 

Iff 

s 


3 

Iff 


10. PROGRAM ADMINISTRATION: 

DON ONLY 


(1) 


15. TYPE OF TRANSACTION DOCUMENT 

NON CONVERTIBLE TO CASH OR BENEFIT 


JOINT SERVICE 


(31 


CONVERTIBLE TO SERVICES ONLY 


THIRD PARTY tCONTRACTOR) 
• HEAVY INVOLVEMENT 


DIRECTLY CONVERTIBLE TO CASH 


(A1 


• total INVOLVEMENT 


(SI 


11. SCOPE OF WRITTEN AUTHORITY: 

PRECISE 


( 1 | 


18. INTERVAL SINCE MOST RECENT 
EVALUATION OR AUDIT: 

V .THIN LAST 9 MONTHS 


BETWEEN 9 AND 24 MONTHS 


CLARIFICATION REQUIRED 


(31 


MORE THAN2YEARS 


NO WRITTEN AUTHORITY 


(51 


17, 


12 . 


AGE/STATUS OF PROGRAM: 

RELATIVELY stable 


Cl 


RECENT INSTANCES OF ERRORS OR 
IRREGULARITIES: 

NONE IN THE LAST 19 months _ 


changing 


131 


NEW OR EXPIRING within 2 YEARS 


(51 


MOST SIGNIFICANT FINDINGS OR KNOWN ERRORS 
FULLY CORRECTED _ 


13, 


EXTERNAUMPACT OR SENSITIVITY: 

NOT applicable 

LQWLEVEL_ 


moderate level 


HIGHLEVEL 


14. 


INTERACTION ACROSS ORGANIZATIONS 

EXCLUSIVE TOONEOFFICE_ 


WITHIN twofunctional offices 


MORE than twofunctional offices 


INVOLVEMENT WITH OUTSIDE ORGANIZATIONS 


i3L 


(51 


IlL 


i2L 


(«i 


(51 


MOST SIGNIFICANT findings OR KNOWN ERRORS 
UNRESOLVED 


18. ADEQUACY OF REPORTS: 

accurate and timely 


SOMETIMES inaccurate, INCOMPLETE AND OR 
LATE _ 


USUALLY INADECJUATE AND LATE 


19. TIME CONSTRAINTS: 

NOT A SIGNIFICANT FACTOR IN OPERATIONS 


OCC ASSKJN ALL Y A F AC TOR 


A SIGNIFICANT DAILY FACTOR 


( 1 | 


(31 


(51 


(11 


(31 


(51 


Cl 

(31 


151 


Cl 


(31 

(51 


(11 


(31 


(51 


► OP 

* t 9 

S*5 

1«« 

sJ Mi I 

% Mi M I 

f ! 

* 

< t 


20. ASSUMED EFFECTIVENESS OF 
EXISTING CONTROLS 

CONTROLS ADEQUATE 


Cl 


LESS than adequate 


(31 


NO EXISTING CONTROLS OR COSTS 
OUTWEIGH BENEFITS 


(51 


21. OVERALL VULNERABILITY 
ASSESSMENT: 

LOW o ILESS than jn 

MEIYUM G IJY Ml 

HIGH □ (OREATER than mi 


22. MCRRECOtntENDEDT 


Mi O HO 


SCORE 


23. 


V* COHOUCTtO 0Y 


0«t8 


95 VA tY 




NAVCOMPT rO«M 2213 , Mi 
S N 0104 Lrr02-2I30 
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5200 

Ser/Orig Code 
(Date) 


FORMAT OF BASIC CERTIFICATION LETTER 


From: Responsible Official (Component Head or Deputy) 

To: (Next higher level in the chain of CMonand) 

Subj: MANAGEMENT CONTROL CERTIFICATION STATEMENT 

Ref: (a) SECNAVINST 5200.35B 

End: (1) Current Year Accomplishments/Naterial Weaknesses 
Identified and Corrected 

(2) Current Year Material Weaknesses and Corrective Actions 

(3) Prior Year(s) Material Weaknesses - Status of Corrective 
Actions 

(4) Risk Assessment Report and Management Control Plan 

1. The ( title of component ) has evaluated the system of internal 
administrative and accounting control in effect during the Fiscal 

Year ending 30 September 19_. The evaluation was performed per 

Department of the Navy policy contained in reference (a). Infor¬ 
mation to support the statement was derived from the management 
control program, audits, inspections, investigations, and other 
management reviews. Except for identified material weaknesses, 
the system of internal control in effect during the fiscal year 
provided reasonable assurance that the objectives of the Federal 
Managers' Financial Integrity Act were achieved. 

2. Enclosure (1) provides 19_ management control program accom¬ 

plishments and material weaknesses identified and corrected this 
fiscal year. Material weaknesses with ongoing corrective actions 
identified this fiscal year and the status of corrective actions 
for prior year(s) weaknesses are reported in enclosures (2) and 
(3), respectively. Enclosure (4) provides the risk assessment 
report and Management Control Plan for this fiscal year. 

Signed 

Component Head or Deputy 
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FORMAT FOR REPORTING ACCOMPLISHMENTS OR MATERIAL WEAKNESSES 


1 . 

2 . 


Title of the accomplishment or weakness. 


Source. 


- Provide the source(s) used to identify this accom¬ 
plishment or material weakness, e.g.,: 


* Management Control Review 

* DOD(IG) finding 

* Naval Audit Service finding 
® GAO finding 

* Internal Review finding 
® Service IG finding 

® Other 


Description. 


- Provide a brief statement describing the accomplish¬ 
ment or material weakness. 


4. Corrective actions ; 

COMPLETION 

MILESTONES ' DATES _ 

- Provide corrective actions for material weaknesses in 
the form of milestones with an estimated completion 
date for each milestone. 
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APPENDIX D 


MANAGEMENT CONTROL PROGRAM— 

CRITERIA TO DETERMINE THE MATERIALITY OF WEAKNESSES 

(a) Actual or potential loss of resources 

(b) Sensitivity of the resources involved 

(c) Magnitude of funds, property, or other resources 
involved 

(d) Frequency of actual and/or potential loss 

(e) Current or probable media interest (adverse publicity) 

(f) Unreliable information causing unsound management 
decisions 

(g) Diminished credibility or reputation or management 

(h) Impaired fulfillment of essential mission 

(i) Violation of statutory or regulatory requirements 

(j) Impact on information security 

(k) Failure of the Government to provide the public with 
needed services 

(l) Apparent conflict of interest. [Ref. 22] 
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APPENDIX E 


SELECTIONS FROM THE 1989 NAVY MANAGEMENT 
CONTROL CERTIFICATION STATEMENT 


The following material weaknesses were selected from the 

1989 Navy Management Control Certification Statement. 

1. Reporting Category : Procurement 

2. Title ; Asset Capitalization Program 

3. Source ; GAO Audit NSIAD 89-147, Plant Modernization; 
DOD's Management of the Asset Capitalization Program 
Needs Improvement, August 1989 

4. Description ; The Asset Capitalization Program (ACP) 
does not have all the essential elements of a sound 
capital investment management program. The program 
lacked top management support and organizational 
responsibilities were unclear. It lacked a systematic 
approach to identifying investment opportunities, 
including long range activity modernization plans. 

Some activities had inadequate and inaccurate 
accounting records for depreciation expenses and plant 
property. Many project files did not contain complete 
information on the history of each project, date of 
receipt, installation and initial operation or were 
missing invoice documents because the activities either 
lacked specific or adequate guidance on what should be 
contained in the files. 

5. Potential Conseguences ; Investment opportunities may 
be missed. Equipment items would not be depreciated 
and, in some cases, equipment would not be accounted 
for. 

6. Related Appropriationfs) ; Navy Industrial Fund 

7. Corrective Actions; 


MILESTONES STATUS 

Direct commands to comply with existing 31 Mar 1990 

guidance to ensure that capital 
investments are consistent with the 
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activities' strategic plans and that 
projects are implemented in a timely 
manner. 

Direct commands to comply with existing 31 Mar 1990 

internal control procedures, develop 

procedures to verify that actual costs 

of equipment are recorded on depreciation 

and plant property records, and 

follow-up to ensure internal control 

procedures are being followed. 

Direct commands to assign sufficient 30 Jun 1990 

personnel to manage and execute 
the program. 
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1. Reporting Category ; Supply Operations 

2. Title ; Receipt Confirmation 

3. Source ; GAO Audit NSIAD 88-179, Inventory Management, 
Receipt Confirmation problems, July 1988; and DoDIG 
Audit 89-114, Control Over Spares For New Weapon 
Systems, 22 Sep 1989 

4. Description ; Under the source acceptance method of 
expedited receipt, payments are made based on 
government inspection and acceptance of material at 
vendors' plants rather than upon receipt at government 
facilities. Navy systems did not have adequate 
controls to ensure that depots received material paid 
for on the basis of source acceptance. Additionally, 
controls over initial spares shipped from contractors 
to storage and user activities were inadequate. 

Internal control procedures had not been established to 
ensure that activities received initial spares and 
recorded the receipts in a timely manner. 

5. Potential Conseguence ; Receipt confirmation and timely 
recording of receipts are the only basis for assuring 
that the government either receives what it paid for or 
recovers payments for items not received. 

6. Related Appropriationfs) ; O&MN; WPN; APN; SCN; and OPN 

7. Corrective Actions; 


MILESTONES 


Establish interim procedures to ensure 
follow-up and recognition of in-transit 
source accepted shipments. 

Implement revised Navy systems 
containing automated procedures to 
accomplish the necessary reconciliation 
and follow-up of in-transit source 
accepted shipments. 

Establish and Implement controls to 
require storage and user activities 
to acknowledge and record initial spares 
receipts within 60 days of date of 
shipment. 

Establish a system to follow-up on 
initial spares shipments that 


STATUS 


Completed 


30 Sep 1991 


30 Dec 1990 


30 Dec 1990 
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storage and user activities have not 
acknowledged as being received. 
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1. Reporting Category ; Personnel and/or Organization 
Manage^aent 

2. Title ; Reinvestigating Top Secret Clearances 

3. Source ; Command Inspections, Staff Oversight Reviews 
and Management Analyses 

4. Description ; Prior to July 1989, the Navy did not have 
a central file identifying military and civilian 
personnel with Top Secret security clearances. With 
the centralization of clearance determinations 
performed by the Department of the Navy Central 
Adjudication Facility (CAF), a personnel security 
clearance data base now exists. However, due to 
resource constraints and higher priorities, a program 
has not yet been established which will identify those 
individuals whose background investigations require 
updating, systematically notify commands to initiate 
reinvestigations, and monitor command control for 
ensuring initiation of reinvestigations. 


5. Potential Consequences ; One command identified almost 
3700 personnel holding Top Secret clearances without 
having been subjected to a periodic reinvestigation 
within the past five years. This condition could 
result in the failure to identify, in a timely fashion, 
cleared personnel who may no longer be eligible for 
clearance due to disqualifying activities. 

6. Related Appropriationfs) ; O&MN 

7. Corrective Actions; 


MILESTONES 


STATUS 


Establish a centralized data base of Completed 

personnel holding Top Secret clearances. 

Identify all personnel holding Top 1 Jan 1990 

Secret clearances without reinvestigations. 


Identify all personnel having Top Secret 1 Jun 1990 
clearances whose background investigations 
or secret background investigations were 
accomplished prior to 1984. 

Establish procedures to notify commands to 1 Jul 1990 
request Defense Investigative Service to 
conduct Periodic Reinvestigations (PRs). 
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Establish procedures to ensure reinvest!- 1 Dec 1990 
gations are conducted as required. 
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1. Reporting Category : Supply Operations (OSD 88-15) 

2. Title of Weakness : Cataloging of supply items 

3. Source ; Department of Defense Inspector General Audit 
Report 88-053 

4. Description ; The system of internal controls was not 
adequate to ensure that supply items were sufficiently 
or accurately cataloged within the Federal Catalog 
System. Items were insufficiently described, 
inaccurately cataloged, prematurely cataloged, and 
unnecessarily assigned a national stock number. 

5. Potential Conseguence ; Improper cataloging of supply 
items increases the risk of undetectable duplication of 
national stock numbers in the supply system, is a poor 
use of resources, and degrades the quality of data by 
which users determine if items meet their requirements. 

6. Corrective Actions; 


MILESTONES 


STATUS 


Establish internal controls to ensure 30 Jun 1989 

that available manufacturers' data are Completed 

obtained/used during the cataloging 
process to facilitate the appropriate 
identification of items. 


Establish internal controls to ensure that 30 Jun 1989 
the identification of previously cataloged 
completed items are upgraded when the 
requisite additional data becomes 
available. 


Implement internal controls to ensure that 30 Jun 1989 
a quality assurance program, as specified Completed 
by DOD Manual 4130.2-M, is employed. 


Implement internal controls to assign 30 Jun 1989 

item management codes in accordance Completed 

with the criteria included in DOD 
Directive 4140.26, "Integrated Material 
Management of Consumable Items." 
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1 . 


Reporting Category ; Property Management (OSD 88-24) 


2. Title of Weakness ; Inadequate procedures for control, 
storage and disposal of hazardous waste 

3. Source ; GAO Survey Code 392337, Naval Inspector 
General finding; Management Control Reviews 

4. Description : Proper storage facilities are not always 
adequate or don't exist; procedures for control and 
disposal are sometimes inadequate; hazardous wastes are 
not properly stored and secured at confirming sites 
while awaiting usage or disposal; hazardous waste is 
not always properly labeled; lack of checklist to 
conduct annual reviews of hazardous waste and material; 
and lack of procedures for control and disposal of 
hazardous waste. 

5. Potential Conseguence ; Inadequate storage of 
incompatible chemicals could result in a fire/explosion 
and inadequate disposal of hazardous waste could be a 
cause for air/water pollutants. 

6. Corrective Acti ons: 


MILESTONES STATUS 

Update hazardous material inventories to Completed 

list correct method of storage and disposal. 

Review hazardous chemicals inventories; turn Completed 
in for disposal all chemicals that are not 
required for current needs. 

Prepare standard checklist to be used to 15 Dec 1989 
conduct annual reviews of hazardous waste Completed 

and material and require all commands 
and activities to conduct annual reviews. 

A Navy standard checklist has been completed. 

The requirement for activities to conduct 
annual reviews has been included in the 
Environmental Compliance Evaluation System. 

OPNAVNOTE 5090, of 20 June 1989, provides a 
means to monitor, achieve and maintain 
compliance with environmental regulations. 

Supplemental checklists covering many of the 
states are now available, the remaining (5) 
state checklists will be developed under 
contract by December 1990 assuming that FY-90 
funds are available by November 1989. Based on 


75 




the correct actions taken to date, this milestone 
is considered substantially complete 


Revise procedures for control and disposal 
of hazardous material and classify program 
responsibi1ities 


1 Aug 1989 
Completed 
20 Jun 1989 
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1. Reporting Category ; Property Management (OSD 88-25) 

2. Title of Weakness : Lack of effective Missing, Lost, 
Stolen, Recovered Property (M-L-S-R) reporting program 

3. Source : Management Control Reviews, Inspection. 

4. Description : Procedures for processing missing and 
damaged property are, in some instances, improper; 
there is a lack of loss prevention programs; and there 
is no command emphasis and oversight in the area of 
accountability. 

5. Potential Consequences : Failure to comply with 
reporting requirements may result in degradation of the 
security program, continued and increased losses of 
Government property, inability to develop trends and 
analyses, and reduced capability to recover missing 
property. 

6. MILESTONES 


Revise M-L-S-R guidance and assign 
Program Manager to monitor M-L-S-R 
Reporting Program. 

Propose that M-L-S-R Reporting Program be 
reinstated as a special interest item on 
command inspections. 


STATUS 

15 Nov 1988 
Completed 
18 Oct 1988 

1 Jan 1989 
Completed 
14 Dec 1988 


Note: Reported complete in 31 March 1989 Status Report. 
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1. 


Reporting Category : Support Services (OSD 88-45) 


2. Title of Weakness ; Inadequate audit standards, 
performance, training, and reporting 

3. Source ; Naval Audit Service Reports C37116, 013-C-88, 
006-N-88, 023-C-88; General Accounting Office Review of 
the Effectiveness of the Naval Audit Service; 

Department of Defense Inspector General quality 
assurance reviews 

4. Description ; The effectiveness of the Naval Audit 
Service non-appropriated fund, and exchange audit 
components has been hampered by the lack of properly 
qualified and trained audit personnel; inadequate 
supervision in the planning, performing and reporting 
of audits; lack of audit evidence documentation and 
standardization of audit reports; improper use of audit 
personnel to perform nonaudit tasks; and instances of 
compromise of audit independence. 

5. Potential Conseguence ; Inadequately qualified and 
trained personnel are unable to perform quality audits 
thereby diminishing the effectiveness of the entire 
audit program. Due to lack of adequate supervision, 
audits are not planned, conducted, and reports written 
in accordance with Comptroller General's standards for 
examination and evaluation. Frequent turnover in audit 
personnel is experienced. Lack of audit independence 
jeopardizes the integrity of the audit program. 

6. Corrective Actions; 


MILESTONES STATUS 

Establish Naval Audit Service (NAVAUDSVC), Completed 

Commandant of the Marine Corps (CMC), Navy 
Resale and Services Support Office (NAVRESSO), 
and Chief of Naval Operations (CNO) documen¬ 
tation procedures to ensure audit report 
content and format requirements are met. 

NAVAUDSVC alter the composition of the Completed 

annual audit plan to provide greater 
potential for management improvement, 
readiness improvement, and monetary savings. 

NAVAUDSVC document the supervisory process Completed 

for producing audits and properly oversee 
administrative functions to produce quality 
audits. 
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Assign command control to maximize 
NAVAUDSVC, CMC, NAVRESSO audit group's 
independence. 

Train CMC, NAVRESSO, CNO audit staff on 
workpaper preparation and filing standards 
and establish procedures to control and 
safeguard workpapers. 

Institute procedures at NAVRESSO for the 
positive verification of prospective 
employees' educational qualifications 

Prohibit use of NAVRESSO audit personnel 
for non-auditing tasks. 

Establish and submit new staffing standards 
and assign CMC staff accordingly. 

Develop written procedures to guide CMC, 
NAVRESSO, CNO auditors in recognizing 
potential instances of fraud, waste, and 
illegal acts, extending audit steps, and 
notifying DOD investigative agencies. 

Develop and implement a formal training 
program for both auditors and 
supervisors at NAVAUDSVC, CMC, NAVRESSO. 


Completed 


Completed 

Completed 

Completed 

Completed 

1 Dec 1988 
Completed 
22 Dec 1988 

30 Sep 1990 
On target 
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1 . 


Reporting Category ; Support Services (OSD #87-49) 


2. Title of Weakness ; Management of certain aspects of 
health care operations 

3. Source ; NAVAUDSVC Report T38086 and Command 
Inspection Report 

4. Description : Effective management oversight was 
lacking in certain Navy health care operations thereby 
hampering development and implementation of a 
comprehensive health care management plan. Appropriate 
analytical techniques and information resources were 
either not used or were unavailable to monitor and 
improve the delivery of health rare. A centralized 
automated information system did not exist to collect 
and analyze malpractice data, impairing the Navy's 
ability to assure quality care and reduce the risk of 
financial loss from claims. Support for the increasing 
use of medical services contracts was inadequate. 
Procedures related to replacing, maintaining and 
controlling medical and dental investment equipment 
were inadequate or were not being followed. Also, the 
medical/dental manpower planning function was found to 
be fragmented and ineffective. Medical unit 
requirements were not being developed against wartime 
missions resulting in potential wartime shortages in 
critical medical subspecialties. Appropriate policy 
direction, oversight and resource advocacy for 
Operational Medicine (OM) was lacking. Shortfalls in 
OM capabilities adversely impact the warfighting 
capability of the Navy and Marine Corps. 

5. Corrective Actions ; 

MILESTONES 

Develop a system to track medical 
personnel status and requirements 
relative to both peacetime and 
wartime billets and deployments. 

Increase the visibility and support 
of OM to enhance its capability and 
heighten the level and quality of 
medical support to the operating forces. 

Ensure manpower authorizations reflect 
a reserve requirement when a wartime 
billet cannot be filled from active duty 
end-strength. 


STATUS 

Completed 


Completed 


1 Dec 1989 
Revised to 
1 Oct 1990 
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The entire shore organization of 
Navy medicine is being reorganized. 

Some organizations will be realigned, 
some will be disestablished and others 
will be provided different missions. 

When manpower authorizations are finalized, 
the active/reserve configurations will be 
ensured. 

Evaluate and reemphasize procedures 
for management and control of health 
care equipment. 

Analyze the difference between peacetime 
and wartime manpower requirements and 
develop a plan to bridge the gap. 

Establish procedures and develop a 
management information system to 
ensure appropriate health care quality 
indicators are reviewed, analyzed and 
acted upon. 

Guidance issued prescribing format 
and content of the Management Infor¬ 
mation Report (MIR). MIR submissions 
due 1 February 1990 will be reviewed 
for thoroughness, utility, and docu¬ 
mentation of appropriate action by 
oversight activities during review and 
endorsement. Assessment of MIRs utility 
expected by 1 May 1990. 

Develop a manpower planning system which 
requires the use of staffing standards, 
identifies shortfalls, prioritizes 
current and future workload and integrates 
reserve and active forces. 

The ASD(HA) health care standards 
are being used in the present Navy 
Manpower Management Operating System. 
However, a manpower planning system 
meeting the milestone requirements 
will not be in place until the Navy's 
reorganization of the medical depart¬ 
ment is completed. 

Establish a centralized automated system 
to collect and analyze malpractice data. 


Completed 


1 Dec 1989 
On target 


30 Dec 1990 
Revised to 
1 May 1990 


1 Dec 1989 
Revised to 
1 Oct 1990 


1 Oct 1990 
On Target 
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1 . 


Reporting Category : Property Managememt (OSD #86-25) 


2. Title of Weakness ; Inaccurate control and 
accountability over tool inventories 

3. Source ; Audits and Management Control Reviews 

4. Description : Controls and accountability over tool 
inventories are inadequate. Adequate policies, 
procedures and accountability for tools are not 
established. Comprehensive physical inventories are 
not conducted periodically. Controls are inadequate or 
have not been implemented for reporting lost, damaged 
or stolen tools. Reports on missing, lost, stolen or 
recovered tools and inventory discrepancies were not 
made and investigated. Automated tool control systems 
do not provide for complete accountability and control 
of millions of dollars of tools. Centralized 
accountability, control and receipt over all tools is 
not established at all activities. Employee 
accountability for lost tools is not enforced. Follow¬ 
up procedures are not in effect to ensure that tools 
are returned within established issue periods. 

5. Corrective Actions; 


MILESTONES 


CNO designate a command to serve as 
the Navy focal point for tool control 
accountability. 

Determine adequacy of controls neces¬ 
sary to maintain accountability over 
tool inventories and evaluate cost/ 
benefits. 

CNO develop and issue a comprehensive 
instruction covering policy, procedures 
and accountability for tools. 


STATUS 

Completed 


Completed 


1 Jun 1989 
Completed 
10 Mar 1989 


Note: Reported complete in 31 March 1989 Status Report. 
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1 . 






Reporting Category : Comptroller/Resource Management 
(OSD #85-50) 

2. Title of Weakness ; Travel advances 

3. Source ; Audit and Management Control Reviews 

4. Description ; Weaknesses in the control of travel and 
travel advances were pervasive throughout the DON. 
Insufficient controls existed to ensure that Permanent 
Change of Station (PCS) and Temporary Duty for 
Instruction (TEMDUINS) travel advances are liquidated 
in a timely manner. Procedures for follow-up and 
settlement of outstanding travel advances and 
management of travel funds were found to be inadequate. 

5. Corrective Actions; 


MILESTONES 


STATUS 


CNO develop a plan of action and mile- 30 Sep 1988 

stones to address travel/travel advance Completed 

related deficiencies from a Navy-wide 
perspective and complete appropriate 
corrective actions. 


CMC apply review emphasis in the areas 30 Sept 1991 

of follow-up and settlement of travel On Target 

advances to obtain substantial correction 
of weaknesses Marine Corps-wide. 


Incorporate improved travel control 
and monitoring capabilities in the 
Standard Accounting, Budgeting and 
Reporting System (SABRS). 

Provide improved temporary addition¬ 
al duty computation, management 
reporting and check production 
capabilities through the Marine 
Corps Travel Advance and Settlement 
System (MCTASS). 


30 Nov 1988 
Completed 


30 Sep 1991 
On Target 


Source; [Ref. 34] 


I 
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APPENDIX F 


ADDITIONAT. READING LIST 


GAO Government Auditing Standards ^ 

GAO Standards for Internal Controls in the Federal 
Government, 1983 

GAO/APMD 88-10. Financial Integrity Act. Continuing 
Efforts Needed To Improve Internal Controls and 
Accounting Systems 

0MB Circular A-123, revised 16 August 1983 

DODD 7040.6, Internal Control Systems, 24 March 1982 

DODD 7600.2, Audit Policies, 10 January 1985 

DODD 7600.7-M, Internal Audit Manual, June 1986 

DODD 7650.3, Followup on General Accounting Office, DOD 
Inspector General, Internal Audit, and Internal Review 
Reports, 5 September 1989 

SECNAVINST 5200.35B, DON Management Control Program, 25 » 

March 1988 

SECNAVINST 7510.7D, DON Internal Audit, 9 May 1989 

SECNAVINST 7510.9, Command Management Economy, Efficiency 
and Review, 13 April 1989 


: 
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